Privacy Policy
Effective October 17, 2026
The short version: SignalDesk uses your information only to schedule, publish, and report on your social media posts. It doesn’t sell your data, show ads, or use tracking or advertising cookies. You can disconnect accounts, export your data, or ask for everything to be deleted at any time.
Who we are
SignalDesk is a social media planning and publishing tool run by PK Works (“we” or “us”). If you have questions about this policy or your data, email phil.kukawinski@gmail.com.
What we collect
Your account
Your email address and, if you add it, your name. Your password is handled by our sign-in provider and stored only in hashed form; we never see it.
What you put into SignalDesk
Clients, posts and captions, images and videos you upload, image descriptions, notes, templates, brand kits, campaigns, goals, link-in-bio pages, and settings. Team members you invite to your workspace can see this content.
Social accounts you connect
When you connect Facebook, Instagram, Threads, LinkedIn, Pinterest, X, YouTube, or TikTok, you sign in on that network’s own page and choose what to allow. We never see your password for those networks. We receive:
- An access token that lets SignalDesk act on your behalf. It is encrypted (AES-256-GCM) before it is stored.
- Basic details about the accounts you can manage, such as the account or Page ID, name, username, profile picture, and profile link, and for Pinterest, your board names.
- For Facebook and Instagram, your app-specific Facebook user ID, so we can delete your connections if you remove SignalDesk from your Facebook settings.
Information from the networks about your posts
If you turn on click counting, links in your posts are replaced with short SignalDesk links. When someone opens one, we add one to that link’s click count for the day and send them on. We don’t store who clicked, their IP address, or any cookie.
For posts published through SignalDesk, we store the post’s ID and link, and we read performance numbers such as reach, impressions, likes, comments, shares, saves, and clicks. If you use the comment inbox, we read the comments on those posts, including the commenter’s name or username as the network provides it, and send the replies you write.
Client reviewers
If you share a review link, the person reviewing can enter their name, approve posts, and leave comments. We store what they enter.
Notifications
The email addresses you choose for notifications and reports and, if you turn on push notifications, a device address from your browser’s push service.
Technical information
Our hosting provider keeps standard server logs (such as IP address, browser type, and time of request) for security and troubleshooting. Your browser stores your sign-in session and a few preferences, such as theme and calendar settings. We don’t use analytics, advertising, or tracking cookies.
How we use it
- To publish your posts to the networks you chose, at the time you chose.
- To show your calendar, approvals, post history, analytics, and client reports.
- To read and reply to comments when you ask.
- To send the notifications, digests, and reports you turned on.
- To run AI features when you use them, such as drafting captions or describing an image.
- To keep the service secure, fix problems, and prevent abuse.
We don’t sell your information, use it for advertising, or build profiles of you or the people who interact with your posts. Data from Meta (Facebook, Instagram, Threads), LinkedIn, Pinterest, X, Google (YouTube), and TikTok is used only to provide the features you use in SignalDesk, following each network’s developer terms, and is never used to train AI models.
YouTube
SignalDesk uses YouTube API Services to upload the videos you schedule and to read their view, like, and comment counts. By connecting YouTube you agree to the YouTube Terms of Service, and Google’s handling of your data is described in the Google Privacy Policy. You can remove SignalDesk’s access at any time on your Google security settings page. SignalDesk’s use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
Who we share it with
We share information only as needed to run SignalDesk:
- The social networks you publish to. Posts you publish become public or visible on those networks according to your settings there.
- Supabase: database, sign-in, and file storage for uploaded images and videos.
- Vercel: hosting the app and running scheduled publishing jobs.
- jsDelivr and Google Fonts: delivering the sign-in library and fonts to your browser, which shares your IP address with them.
- Resend: sending notification, digest, and report emails.
- Anthropic: AI features you choose to use, such as caption drafts, image descriptions, proofreading, and trend summaries. Only the text, images, and brand notes needed for that request are sent.
- Your browser’s push service (for example Apple, Google, or Mozilla): delivering push notifications to devices where you turned them on.
- Unsplash: stock photo search in the Publishing Studio. Your search words are sent to Unsplash, and photos load from Unsplash’s servers, which shares your IP address with them.
- People you choose to share with: your workspace team, anyone you send a review or calendar link to, and visitors to a link-in-bio page you publish.
- When the law requires it, or to protect the rights, safety, or property of our users or others.
These providers may only use your information to provide their service to us.
How long we keep it
- Your account and workspace content: until you delete them or ask us to.
- Access tokens: deleted right away when you disconnect an account, or when you remove SignalDesk from your Facebook settings.
- Uploaded files that no post or draft uses anymore: deleted automatically after 30 days.
- Sign-in attempts with a network: expire after 15 minutes.
- Deletion requests: completed within 30 days. Copies in our database provider’s backups are removed when those backups expire.
Deleting something from SignalDesk doesn’t remove posts already published on a social network. Delete those on the network itself.
How we protect it
All connections use HTTPS. Access tokens are encrypted at rest, review and calendar links are stored only as hashes, and database access is limited to your own workspace. No system is perfectly secure, but we work to protect your information and will tell you promptly if a breach affects it.
Your choices and rights
- Disconnect any social account in SignalDesk under Clients & Accounts, or remove SignalDesk’s access in that network’s settings.
- Export your workspace and posts from Settings.
- Change or stop notification emails and push notifications from the notification settings.
- Delete your account yourself under Settings → Your account, or see Data deletion.
- Access or correct your information in the app, or email phil.kukawinski@gmail.com.
Depending on where you live (for example in the EU, UK, or California), you may have additional rights, such as to object to or restrict processing, or to complain to your local data protection authority. We will respond to requests within 30 days and won’t treat you differently for making one.
Children
SignalDesk is not meant for children under 13, and we don’t knowingly collect their information.
Changes to this policy
If we change this policy, we’ll update the date at the top and, for important changes, let you know in the app or by email.
Contact
PK Works · phil.kukawinski@gmail.com